Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108726GLPI through 12.0.0 Missing Authorization via ajax/map.php

Medium 4.3

In plain English

A medium-severity missing authorization in GLPI from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	GLPI	0 – through 12.0.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@haind03/glpi-ajax-map-missing-itemtype-authorization third-party-advisory
https://github.com/glpi-project/glpi/blob/cd812fbc82eaa8d0356d0fb650842069c1c18f4e/ajax/map.php#L44-L52 technical-description
https://github.com/glpi-project/glpi product
VulnCheck Advisory: GLPI through 12.0.0 Missing Authorization via ajax/map.php third-party-advisory